Most security leaders know the feeling. Something breaks overnight, and by 8 a.m. an executive wants to know what it means for the company, the people, and the quarter. The Clarity Factory's 2026 Annual Chief Security Officer Survey, released in September, puts hard numbers behind that pressure.
Rachel Briggs OBE and her team surveyed CSOs in March and April 2026, and 118 responses from multinational companies with more than 3,000 employees made the final dataset. Most of the report speaks to the CSO's seat at the leadership table. This post looks one floor down, at the GSOC, because much of what the survey describes lands on the analysts and operators who watch the feeds, write the alerts, and make the first call.
In 2025, four security risks were rated 'critical' or 'high' by more than half of CSOs. In 2026, that number rose to seven. Cyberattacks, geopolitical risk, data and IP theft, insider risk, and reputational risk sit at the top of the list, with cyber still in first place and about three quarters of CSOs rating it critical or high.
A few figures stand out for anyone running a watch floor. Geopolitical risk was rated critical by 28% of CSOs, up from 13% a year earlier, and 74% rated it critical or high. Armed conflict climbed to 41% critical or high from 31%. The share of CSOs placing ongoing conflicts in their top five geopolitical risks jumped from 37% to 67%, the largest increase anywhere in the dataset. Travel risk went from about a third of CSOs rating it critical or high to a majority.
The report notes that the survey opened just as the conflict with Iran began, which may have lifted some of those numbers. Even allowing for that timing, a GSOC now carries more risk categories that need standing monitoring, defined escalation thresholds, and a named owner on the business side.
The survey tracks a steady change in how corporate security teams are built. Roles in intelligence, crisis and resilience, and what the report calls higher-value GSOC positions are growing. Guarding, site security, and operator-level GSOC roles are shrinking. Budgets follow the same pattern, with money moving toward GSOC modernization, fusion centers, and systems integration, and away from manual operations.
One CSO interviewed for the report summed it up: "GSOCs need to get away from being too tactical."
There is a catch though. More intelligence output hasn't translated into more influence. Only 25% of CSOs said their intelligence products frequently shaped business decisions over the past year, and about a third said they rarely did or didn't at all. The audience has grown, with more security teams now serving business leaders and cyber colleagues, yet reach and impact are separate measures. Since the GSOC produces much of a security team's daily reporting, it is a sensible place to start closing that gap.
'Intelligence-led' can sound like a slogan until you put it into a shift schedule. In practice, it shows up in a handful of habits.
The five risks CSOs ranked highest each have a GSOC angle, and several of them overlap.
None of this requires a bigger headcount for most. The report found that team size had no link to the number of areas a security function is responsible for, so most GSOC managers are working with what they have. A few practical moves can shift the floor toward intelligence-led work within a quarter:
The full Clarity Factory report runs to roughly 90 pages and is free to download. The sections on intelligence and on corporate security teams are worth reading in full for anyone who manages a GSOC or the people in it.